$50K in Bug Bounties Confirms AI Customer Service Agents Are Live Attack Targets

What happened

Why it matters

• ·Enterprises approving AI customer service agents through standard vendor intake processes are unlikely to have evaluated prompt injection via email, MFA bypass, or OTP exfiltration as live risk categories. These gaps sit outside conventional application security threat models and require agent-specific controls.
• ·When an AI agent sends phishing messages from a legitimate support address, the enterprise may bear liability for those communications. Authentication bypass through agent tool access creates credential and fraud exposure that existing incident classification frameworks may not cover.
• ·The bounty program validation means adversaries already understand these attack chains. Enterprises that have not conducted agent-specific red-teaming against their customer service deployments are operating with an unexamined attack surface in production.

Governance controls affected

What to do now

• ☐Audit all deployed AI customer service agents for email integration access and revoke or scope-limit any permissions that allow agents to send outbound email without human approval.
• ☐Require agent-specific red-teaming that explicitly tests prompt injection via email, phishing via support addresses, and authentication workflow manipulation before the next deployment review.
• ☐Review vendor contracts for AI customer service platforms to confirm incident notification requirements cover agent-facilitated phishing and credential exfiltration, not just data breaches.
• ☐Map agent tool-calling permissions against the principle of least privilege: agents that handle authentication workflows should not have access to outbound communication channels without explicit scoping.
• ☐Update the AI incident classification framework to include agent-facilitated phishing, MFA bypass, and OTP exfiltration as named incident categories with defined response procedures.

What to watch next

The Intigriti research is one of several converging signals that agent-specific red-teaming is moving from best practice toward a baseline expectation. Compliance teams should monitor whether bug bounty platforms begin publishing structured taxonomies of AI agent attack classes, which would accelerate regulatory and auditor expectations for pre-deployment testing scope. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already identifies prompt injection and unauthorized action as priority risks. Enforcement bodies that incorporate that guidance into inspection criteria will likely scrutinize whether organizations tested email-channel injection paths before deploying customer-facing agents.